0

On a machine I (tlous) have been given access to open a shell as another user (serviceAccount)

Executing: sudo su - serviceAccount has the desired effect of opening a shell as this serviceAccount user. So far so good.

This is nice, but I want to run a command as this user without opening a shell.

Let's say the command is whoami

I've tried:

sudo -u serviceAccount whoami

Sorry, user tlous is not allowed to execute '/usr/bin/whoami' as serviceAccount ...

sudo su - serviceAccount -c whoami

Sorry, user tlous is not allowed to execute '/bin/su - serviceAccount -c whoami' ...

And other variations. What am I missing? Can this be done in a oneliner? The reason is that I actually want to run this as an ssh command: ssh -t [email protected] sudo su - serviceAccount -c whoami

Update 20190412 with sudo -l

sudo -l

Matching Defaults entries for tlous on this host:
    !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY
    LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, !authenticate

User tlous may run the following commands on this host:
    (root) /usr/bin/su - serviceAccount, /bin/su - serviceAccount
Improve this question
1
  • 2
    Add the output of sudo -l to the question, please.
    – muru
    Apr 12, 2019 at 12:59

2 Answers 2

Reset to default
0

Based on your output from sudo -l, to wit:

User tlous may run the following commands on this host:
    (root) /usr/bin/su - serviceAccount, /bin/su - serviceAccount

You are given explicit rights in the sudoers configuration to run two specific commands:

  • /usr/bin/su - serviceAccount
  • /bin/su - serviceAccount

Adding more parameters, as you're trying (e. g. sudo -u serviceAccount whoami) is not on the approved command list.

You will need to request that your system administrator add to the sudoers configuration the other commands you desire access to run via sudo.

Improve this answer
-1

Maybe you can try this:

ssh -t [email protected] "sudo -u serviceAccount whoami"

Improve this answer
5
  • Already tried that (see first below I've tried)
    – Tom Lous
    Apr 12, 2019 at 13:02
  • Edit sudoers file and allow user serviceAccount to execute that command
    – Igor Smitran
    Apr 12, 2019 at 13:13
  • If I could do that I wouldn't have this issue in the first place :-)
    – Tom Lous
    Apr 12, 2019 at 13:14
  • Maybe you can try this instead: ssh -t tlous@server.example.com "sudo su -c whoami serviceAccount"
    – Igor Smitran
    Apr 12, 2019 at 13:20
  • I have tried what you are trying on my VM and it seems to work fine. What OS are you on?
    – Atul
    Apr 12, 2019 at 15:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .